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We report on a complete experimental implementation of a quantum key distribution proto- 
col through a free space link using polarization-entangled photon pairs from a compact parametric 
down-conversion source. Over 10 hours of uninterrupted communication between sites 1.5 km apart, 
we observe average key generation rates of 630 per second after error correction and privacy amplifi- 
cation. Our scheme requires no specific hardware channel for synchronization apart from a classical 
wireless link, and no explicit random number generator. 
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Quantum key distribution [IJ is probably the most ma- 
ture application developed out of quantum information 
science during the last decade. Based on initial ideas 
of Wiesner [2( , quantum states of physical systems with 
small Hilbert spaces can be used to encode information in 
a way that an illegitimate attempt of accessing that infor- 
mation will result in a perturbation of the state, and con- 
sequently in revealing the interception attempt. Thus, 
the secrecy of a bit string or a key between two parties 
could be ensured relying on fundamental laws of quantum 
mechanics rather than assumptions on the mathematical 
complexity of problems like factoring. 

A specific protocol to establish a secret key between 
two parties was established by Bennett and Brassard 
(BB84) 3], which used the polarization degree of free- 
dom of single photons. An alternative scheme for a quan- 
tum optics based key distribution was suggested by Ek- 
ert 0, where nonlocal correlations in the measurements 
on entangled photon pairs both allow to establish a se- 
cret key and evaluate the knowledge of an eavesdropper 
out of a violation of Bell inequalities. In this scenario, 
only the detection units needed to be in possession of 
legitimate communication partners, while the entangled 
photon source need not to be in a trusted hand. Work 
on security analysis of quantum key distribution systems 
also typically makes use of entanglement, even in the 
case of the original or modified BB84 implementations 
with faint coherent pulses Q- 

Practical implementations of quantum key distribution 
(QKD) can be classified according to the type of protocol 
and the physical transmission channel. We distinguish 
protocols of the prepare and send (PaS) type and en- 
tanglement based schemes. The transmission channel is 
either optical fiber or free space. 

Most demonstrations of QKD (including all commer- 
cial systems) are PaS protocols implemented over fiber 
channels @ and a few over free space Q. The choice of 
channel reflects the maturity of fiber technology and its 
commercial possibilities in current networks. The prefer- 
ence for PaS protocols is due to the technological simplic- 
ity compared with entanglement based schemes. How- 
ever, security in PaS protocols relies on the availability 
of high bandwidth trusted random numbers, which does 
not need to be the case for entanglement based systems. 

First steps towards entanglement based QKD were ex- 
periments on distributing entanglement in the field over 



fiber links [U and in free space 0, ^} . More recently, 
QKD over a purposely laid fiber link was reported \U\ . 
In this paper we describe a entanglement based (modi- 
fied BB84) full field implementation of QKD over an ad 
hoc free space link. The system is based on a compact 
(80 x 50 cm 2 ) spontaneous parametric down-conversion 
source (SPDC), compact detection modules, a free space 
standard wireless internet protocol link and a software 
synchronization protocol taking advantage of intrinsic 
time correlations in the SPDC process. Error correc- 
tion and privacy amplification are implemented on the 
fly producing a continuous stream of secure key. 

A schematic experimental set-up is shown in figure 1. 
Light at 404 nm emitted by a cw laser diode (LD) is 
circularized and focused (PO) to a waist of 90 (an into 
a /3-barium borate (BBO) non-linear crystal. There, 
polarization-entangled photon pairs are created via type- 
II SPDC out of 50 mW power. An additional half- wave 
plate (WP) and BBO crystals (CC) compensate walk-off 
effects [H G3. These crystals are also used to set the 
relative phase between horizontal (H) and vertical (V) 
polarizations such that the source produces photon pairs 
in a singlet Bell state: 

\*-) = ^(\h) a \v) b -\v) a \h) b ) 

Indices A and B (denoted Alice and Bob) represent two 
spatial modes defined by coupling SPDC light into single 
mode optical fibers (SMF) [L|. Center wavelength and 
spectral bandwidth are 805.2 nm and 6.3 nm for Alice's 
mode, and 810. 7nm and 6.8 nm for Bob's mode. Each 
fiber passes through a polarization controller (FPC) to 
undo fiber induced polarization transformations. At the 
source we observe a coincidence rate of 24 000 s _1 with an 
overall coupling and detection efficiency of 22 %, detected 
by passively quenched Silicon avalanche photo diodes (Si- 
APD). The entanglement quality is verified by measuring 
polarization correlations in H/V and +45/ — 45 basis. We 
observe a visibility of 98 ± 2.6 % and 92 ± 2.2 %, respec- 
tively. 

In a BB84-type QKD experiment, Alice's and Bob's 
polarization detection units (PA) randomly analyze the 
received photons in two maximally conjugated basis 
(H/V and +45 /-45). For this purpose we use compact de- 
tection units [l4| relying on a non-polarizing beam split- 
ter (BS) to ensure the random choice of the measurement 
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FIG. 1: Scheme of the experimental set-up. Polarization- 
entangled photons are distributed between two parties, Alice 
and Bob, separated by 1.5 km. Coincidence identification uses 
time-stamp units and requires a wireless link. 



basis. Projection onto +45/-45 basis in the transmitted 
arm is via a half wave plate (HW) and polarizing beam 
splitter (PBS); in the reflected arm the H/V projection 
is implemented directly with a PBS. Photons are finally 
detected with four Si-APDs cooled to around — 15 °C 
(with outside T=28°C) with an average dark count rate 
of 1000 s -1 per detector. 

Optical ports are situated on the rooftops of two build- 
ings in the campus of National University of Singapore 
(E103° 46' 48.3"; Nl° 17' 48.7" and E103° 46' 3.5"; Nl° 
18' 8"), separated by 1.5km. The entangled pair source 
is connected by 50 m of single-mode fiber to the sending 
telescope (ST) collimating the fiber mode into a Gaus- 
sian beam with a waist of 15 mm. The receiving telescope 
(RT, focal length of 310 mm, diameter 77 mm) focuses 
light onto a pinhole (PH) with 50 fim diameter acting as 
a spatial filter. An interference filter (F, Ao = 810.7 nm, 
FWHM= 5 nm) is used for background suppression. The 
pinhole is imaged (R) onto the Si-APDs in the polariza- 
tion analyzer. The pointing accuracy of the telescopes is 
«10 /xrad. 

In a protocol based on pairs of photons, it is funda- 
mental to identify reliably which events are correlated in 
their times of arrival. With a cw laser pumped source, 
pair arrival times are random on all time scales, both 
due to the preparation process and the randomizing in- 
fluence of losses. In lab experiments and some field imple- 
mentations, coincidence or timing information required a 
dedicated hardware channel 10. Ill|. In our experiment, 
we use a software-based coincidence identification, where 
we continuously register the detection time of all photo- 
events on both sides with a timestamp unit (TU) locked 
to a Rb oscillator 0, Q E3 . 

Before coincidences can be identified, the clocks on 
both sides need to be synchronized to the order of a co- 
incidence time window. We start with a standard NTP 
protocol [16j between the controlling hosts (PC in fig. 1) 



to an accuracy < 100 ms, followed by a tiered cross cor- 
relation on raw photodetection timings. Initial locking of 
the remote clocks takes a few seconds to extract coarse 
and fine timing information with a resolution of 2.048 /is 
and 2 ns, respectively, followed by an FFT algorithm to 
find the maxima of the cross correlation functions. 

For efficient timing communication, we partition detec- 
tion events in packets every 2 29 ns and encode time in- 
tervals between consecutive events, reaching a bandwidth 
« 13 % above the Shannon limit or 1 Mbit per second for 
50 000 events per second. Timing information consumes 
the largest bandwidth of all communication on the clas- 
sical channel, but is comparable to schemes with a fixed 
timing raster which would not allow to work efficiently 
with a cw pumped source. We used a standard 801. llg 
wireless connection (WL) for classical communication. 
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FIG. 2: Quantum key distribution between two sites 1.5 km 
apart. In the top panel, the traces correspond to the raw co- 
incidence rates between the remote sites, sifted and final se- 
cure key after error correction and privacy amplification. The 
bottom panel shows the measured quantum bit error ratio of 
the sifted key. The acquisition took place during an uninter- 
rupted period of w 10 hours at night. The reduced scatter in 
the sifted and error corrected keys is due to the clustering of 
the data for error correction and privacy amplification. For 
clarity, the traces show a downsampled (1 out of 10) subset. 

The coincidence identification is carried out asyn- 
chronously on the high count rate side. Due to timing 
jitter of photodetectors, reference clock noise, clock drift 
servo noise, and noise in time stamp units, we observe a 
cumulative width of 1.4 ns (FWHM) for the distribution 
of coincidence time differences At. For raw key genera- 
tion, we accept coincidences with |Ai| < 1.75 ns. Coin- 
cidences with | At | < 3.75 ns are used to servo the clock 
drifts for continuous operation beyond the reference clock 
stability, which would only allow for only a few min- 
utes of operation. Accidental coincidences (8.63 s -1 in 
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average between 21:00 and 06:00 hours) monitored in a 
3.75 ns wide reference window displaced by 20 ns from 
the main coincidence window are consistent with total 
single event rates on transmitter side (99 692 s -1 ) and 
receiver side (18 325 s -1 ) detectors. To ensure that dif- 
ferent timing delays of individual detectors could not be 
exploited for eavesdropping, we equalized the average de- 
lays to w 0.25 ns. 

We remove errors in the raw key on the fly with a 
modified CASCADE/BICONF error correction algo- 
rithm (following largely ) on clusters of collated raw 
key packets with at least 5 000 bits. The required band- 
width on the classical communication channel is small 
compared to the initial sifting. 

Privacy amplification 18] for obtaining s secure key 
bits out of r raw key bits in a cluster removes possi- 
ble knowledge of an eavesdropper out of an attack (esti- 
mated from the observed error fraction rj in the raw key) , 
and due to the c revealed parity bits in the error correc- 
tion process. We assume an attack-based knowledge of 
an eavesdropper of e = r/2[(l + z)log 2 (l + z) + (1 — 
z)/log 2 (l — z)], with z = 2y/ r/(l — rj). The compression 
matrix for privacy amplification torn — r~e — c final 
key bits is generated on the fly from a publicized seed 
for a pseudo random number generator for every clus- 
ter. All observed errors are assigned to an eavesdropping 
attempt, no assumptions on the inability of an eavesdrop- 
per to access intrinsic errors in the system are made. 

Our results are presented in figure 2. The initial re- 
mote coincidence rate is 2 600 s -1 and drops to 2 000 s -1 
after «10hrs without any intervention or active stabi- 
lization after initial alignment. The secret key exchange 
is finally interrupted by the rising sun saturating the de- 
tectors. The quantum bit error ratio (QBER), i.e. the 
ratio between wrong over correct events, increases slowly 
from ss5% to «6%, with an overall average of 5.4%. 
We do not observe any appreciable increase in QBER 
due to the propagation through the atmosphere. We at- 
tribute the small increase of 0.5% between the local and 
remote QBER to residual uncompensated birefringence 
in the fiber connecting the source to the telescope. Af- 



ter the basis reconciliation the averaged sifted and secret 
keys bit rates are 1 100 s -1 and 630 s -1 . Our error cor- 
rection implementation resulted in a residual bit error 
ratio (BER) of 2 x 10 -5 in this run, clearly bunching in 
particular clusters. After privacy amplification, this lead 
to 230 clusters with nonidentical final key out of 7 500. 

The remote coincidence rate is around 11 % of the local 
rate. We observe a transmission between the entangled 
pair source and the sending telescope of 85%, through 
telescope optics 90 % and through interference filter 50 %. 
Separation of 1.5 km leads to an additional signal reduc- 
tion of 50%. Each detection unit exhibits another 20% 
of losses. We do not observe a significant contribution to 
the losses due to scintillation. 

For a second experiment, we replace the interference 
filter with a long pass filter (RG780). Over 6 hours of 
measurement, around 850 bits per second of secret key 
are distributed on average. The sifted key bit rate in- 
creases to 1600 s -1 with an average QBER of 5.75%. 
The BER before privacy amplification was 2 x 10 -6 on 
cluster sizes > 10 000 bits, leading to 21 nonidentical key 
out of 1 720 after privacy amplification. 

In conclusion, we have demonstrated a real-time free- 
space quantum key distribution based on a BB84-type 
protocol with polarization-entangled photons. A soft- 
ware base coincidence identification scheme was imple- 
mented, not relying on a dedicated hardware channel. 
A nighttime experiment with an interference filter ran 
uninterruptedly for over 10 hours producing an aver- 
age secure key rate of 630 bits per second, while with 
a long pass filter we observed 850 bits per second over 6 
hours. We believe that this QKD set-up can be used even 
for daylight operation: from preliminary experiments we 
estimate that the accidental coincidence rate therefore 
must be reduced by one order of magnitude, which can 
be achieved with stronger spectral and spatial filtering, 
and a shorter coincidence time window. 

The authors acknowledge the DSTA Singapore for 
their financial support and thank Darwin Gosal, Gleb 
Maslennikov, Alexander Ling, Hou Shun Poh and Meng 
Khoon Tey for their help. 



[1] N. Gisin, G. Ribordy, W. Tittel and H. Zbinden, Rev. 

Mod. Phys. 74, 145 (2002) 
[2] S. Wiesner, Sigact News 15, 78 (1983) 
[3] C. Bennett and G. Brassard, in Proceedings of the IEEE 

Int. Conf. On Computer Systems and Signal Processing 

(ICCSSP), publisher Bangalore, India (1984), 175 
[4] A. Ekert, Phys. Rev. Lett. 67, 661 (1991) 
[5] P. W. Shor and J. Preskill, Phys. Rev. Lett.85,441 (2000); 

N. Lutkenhaus, Phys. Rev. A 61, 052304 (2000) 
[6] R. J. Hughes, G. L. Morgan, and C. G. Peterson, J. Mod. 

Opt. 47, 533 (2000); D. Stucki, N. Gisin, O. Guinnard, 

G. Ribordy and H. Zbinden, New J. Phys. 4, 41 (2002); 

C. Gobby, Z. L. Yuan, and A. J. Shields, Appl. Phys. 

Lett. 84, 3762 (2004) 



[7] R. J. Hughes, W. T. Buttler, P. G. Kwiat, S. K. Lamore- 
aux, G. L. Morgan, J. E. Nordholt, and C. G. Peterson, 
J. Mod. Opt. 47, 549 (2000); J. G. Rarity, P. M. Gorman, 
and P. R. Tapster, Electron. Lett. 37, 512 (2001) 

[8] W. Tittel, J. Brendel, H. Zbinden, and N. Gisin, Phys. 
Rev. Lett. 81, 3563 (1998) 

[9] K. J. Resch, M. Lindenthal, B. Blauensteiner, H. R. 
Bohm, A. Fedrizzi, C. Kurtsiefer, A. Poppe, T. Schmitt- 
Manderbach, M. Taraba, R. Ursin, P. Walther, H. Weier, 
H. Weinfurter, and A. Zeilinger, Opt. Express 13, 202 
(2005) 

[10] C.-Z. Peng, T. Yang, X.-H. Bao, J. Zhang, X.-M. Jin, F.- 
Y. Feng, B. Yang, J. Ying, Q. Zhang, N. Li, B.-L. Tian, 
and J.-W. Pan, Phys. Rev. Lett. 95, 030502 (2005) 



4 



[11] A. Poppe, A. Fedrizzi, T. Loriinser, O. Maurhardt, R. 

Ursin, H. R. B6hm , M. Peev, M. Suda, C. Kurtsiefer, H. 

Weinfurter, T. Jennewein, and A. Zeilinger , Opt. Express 

12, 3865 (2004) 
[12] P. G. Kwiat, K. Mattle, H. Weinfurter, A. Zeilinger, A. 

V. Sergienko, and Y. Shih, Phys. Rev. Lett. 75, 4337 

(1995) 

[13] P. Trojek, C. Schmid, M. Bourennane, H. Weinfurter, 
and C. Kurtsiefer, Opt. Express 12, 276 (2004) 

[14] C. Kurtsiefer, P. Zarda, M. Haider, H. Weinfurter, P. M. 
Gorman, P. R. Tapster, and J. G. Rarity, Nature 419, 
450 (2002) 



[15] T. Jennewein, C. Simon, G. Weihs, H. Weinfurter, and 
A. Zeilinger, Phys. Rev. Lett. 84, 4729 (2000) 

[16] D. L. Mills, IEEE Trans. Communications COM-39 10, 
1482 (1991) 

[17] G. Brassard and L. Salvail, in Advances in Cryptology - 
Proc. Eurocrypt'94, pp. 410-423 (1994); T. Sugimoto and 
K. Yamazaki, IEICE Trans. Fundamentals E83-A, 1987 
(2000) 

[18] C. H. Bennett, G. Brassard and J.-M. Robert, SI AM J. 
Comput. 17, 210 (1988) 



